Investigations that survive waiting and restarts

This worked application uses explicit planning assumptions to demonstrate FIELD. Quantities below are inputs, calculated implications or proposed targets; they are not reported customer results. The engagement decision remains conditional on the evidence described.

Planning basis and engagement boundary

F — Frame the outcome

Complete investigations reliably across long waits without losing authority or repeating external actions; define who owns unresolved outcomes.

Value measure: Verified investigation completion, unresolved-operation age and human queue burden.

I — Investigate the workflow

Map approval delays, externally committing steps and human escalation. Establish which actions can be replayed and what cancellation means to users.

First evidence task: Partition ownership while a previously approved external action is in flight.

E — Engineer the solution

Keep durable state, fenced ownership, operation identity and budget propagation; size active versus suspended work separately.

The implementation assessment below makes the authority, workload, resource and failure assumptions concrete. Its numbers are calculations from the stated scenario, not a vendor performance guarantee.

Contract

Separate task deadline from model/tool attempt deadlines and approval expiry. Define which operations are read-only, reversible or externally committing. Approval waits must not hold expensive compute or database transactions open.

Implementation plan

Durable task/event store→scheduler→bounded worker→model/tool gateway→authoritative external system. Task state includes intent revision, plan, evidence references, pending obligations, lease/fencing generation, budgets and action ledger. A suspended task releases its worker; a timer, tool completion or approval event makes it runnable again.

Sizing

At an assumed 20 new investigations/min and 30-minute mean task lifetime, Little's law gives 600 in-flight tasks. If only 10% are actively computing at a typical instant, that suggests 60 active tasks, but their CPU/GPU/API needs still depend on measured work. Store large artifacts outside hot task rows and retain references. One-day approvals increase durable task count without implying equivalent model concurrency.

Failure paths

Leases plus fencing protect local state ownership; stable operation keys protect external effects. Two workers may temporarily run, but only the valid owner may advance state and duplicate calls must be harmless within the effect contract. If a call times out after possible commit, transition to unknown and reconcile. Cancellation prevents future steps but does not erase committed actions.

Approval after cancellation

The approval references an action/intent version and expiry. A cancelled or revised task rejects stale approval; current permissions and resource preconditions are rechecked before any execution. The model cannot revive cancelled authority by writing a plan.

Verification

Inject crashes around intent write, external send, remote commit and local completion. Test duplicate events, stale owners, delayed approvals and workflow-code changes. Verify actual business state, task accounting and bounded cost. A workflow engine can implement durability, but its activity/external-action semantics still require this reasoning.

L — Launch with evidence

Inject worker races, expired approvals and cancellation after dispatch. Accept success only from verified outcomes and explicitly report uncertain actions.

Critical decision condition: Stale approval or conflicting workers must not produce an unauthorized action.

Attach raw artifacts, the tested configuration, population, denominator, date and limitations to the release record. Missing or stale evidence holds the dependent decision. A favorable value forecast cannot offset a failed critical condition.

D — Develop ownership and reuse

An operations owner manages reconciliation and expired work; a business owner controls action policy and approval changes.

Candidate reusable asset: Durable investigation state machine and reconciliation contract.

Commercial decision and next commitment

Accountable decision owner: Investigation workflow owner and service release owner.

The initial commitment is the bounded journey above, with the stated exclusions. Confirm access, customer staffing and acceptance ownership during discovery; price and schedule unresolved dependencies explicitly. A new source, tenant class, language, action or operating envelope requires an impact review rather than silent scope growth.

Approve only the next exposure level supported by the evidence. The next useful investment is: partition ownership while a previously approved external action is in flight.

Method and references

Apply the FIELD method, economic model and evidence rules. Methodological and technical influences are listed in the source register.